5 ms·

This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.

by Mizza 10y ago

throwawaysocks 10y ago
There was no actual intrusion, so this feels like fair game to me. Especially since mitigating a very possible attack vector is a direct result of running experiment. Still, hopefully the researchers got an IRB to sign off on the experiment setup...
- kbenson 10y ago
  Well, there was a small intrusion. It reports back a filtered command history (including just package install commands), the hardware info, and the list of installed modules (along with regular info, like system type, if there are admin privileges, etc). That's not nothing, but it is fairly benign. I was worried about the command history until I saw it was filtered, and that mostly allayed my misgivings.
- placeybordeaux 10y ago
  The research got computers to execute code on them without authorization and extracted information from them. That is a crime under the CFAA in the USA. Not sure what it is in Germany/EU.
  - billyhoffman 10y ago
    "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'"
    - random28345 10y ago
      > "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'" The prosecuting attorney is going to tell a jury of twelve of your non-technical "peers" that it is hacking. Your client can either go to trial for seventeen thousand two hundred and eighty nine counts of felony hacking, and risk half a million years in prison, or they can plea bargain to 5 years in prison and a felony on his record. Or your client can hang himself, but I'm pretty sure a federal prosecutor counts that as a win too.
      - cplease 10y ago
        Yup. I'm surprised an advisor would sign off on this thesis.
    - flashman 10y ago
      That's an interesting point. Is there any case law on negligence versus malice?
  - codedokode 10y ago
    What about Android apps (like Facebook) that collect phone numbers, contact lists, geolocation data, record sound without any user authorization?
tantalor 10y ago
The doc (http://incolumitas.com/data/thesis.pdf http://incolumitas.com/data/thesis.pdf) does have a short section on ethics, but IMHO it completely misses the point of the ethical concerns in running unauthorized, non-sandboxed code on devices you don't own. Instead it justifies the research by saying the threat cannot be shown unless the vulnerability is exploited, which is true, but that fact does not justify the research. The acknowledgements mention 2 of the university advisers and a PyPi admin consented to the "notification program". Still, people with good intentions have been prosecuted and convicted for less. I would be very concerned for this student.
SolarNet 10y ago
Yea, this would never get past my university's ethics department. I'm actually surprised he was allowed to do this. Maybe it's partially due to the fact our ethics department is also worried about liability.
markbnj 10y ago
Perhaps this could have been made cleaner by relying on the package manager for download counts only, and then demonstrating the code execution scenario on research machines only. If you wanted to avoid actually downloading anything to the user's machine (after all, they expect a 404 in this case, not a package even be it a harmless one) you'd perhaps need the cooperation of the repo admins to a greater extent. Anyway, this is all part of why I always try to build inside a container, or at least in a virtualenv where I don't need to sudo the install.
placeybordeaux 10y ago
Yeah I wouldn't want to find myself in court hearing >17000 computers were forced to execute [unauthorized] arbitrary code Certainly a crime in the US, not sure about Germany. Nice execution though!
- twinkletwinkle 10y ago
  I'm not so sure - were they forced? Could you take the maintainer of `requests` to court too? If someone types `pip install reqeusts` and gets something they maybe didn't expect, did you really force them?
  - darkarmani 10y ago
    Are you asking if the maintainer of 'requests' decides to spy on computers and phone home information? What packages do this?
    - twinkletwinkle 10y ago
      Not a laywer, I'm just picking nits. It seems to me when you pip install a package, you are saying "download <this thing> and run its setup.py file". What if requests did something you didn't like, something simple like write a new directory or change the name of a certain file. Could you sue over that? Where is the distinction?
      - placeybordeaux 10y ago
        No one would be suing. This would be criminal. I was thinking that a simple way this would be illegal in the US would be "[accessing] a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer" See a2C here: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#Criminal_offenses_under_the_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#C... I'd assume you can make a decent case that the person only authorized the installation of a piece of software, not the gathering of identifying information. IP addresses can be used as identifying information especially when paired with a timestamp. Being an American citizen living in the US I would not want my name on this paper.
21 10y ago
I wonder about the legality. It looks to me like he isn't technically responsible, since he didn't access any authorized computer himself. If I intentionally leave an infected USB drive on the ground, someone picks it up and sticks it into it's computer, am I liable? Seems like it could go either way.

This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.

by Mizza 10y ago

This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.

throwawaysocks 10y ago

There was no actual intrusion, so this feels like fair game to me. Especially since mitigating a very possible attack vector is a direct result of running experiment. Still, hopefully the researchers got an IRB to sign off on the experiment setup...

kbenson 10y ago
Well, there was a small intrusion. It reports back a filtered command history (including just package install commands), the hardware info, and the list of installed modules (along with regular info, like system type, if there are admin privileges, etc). That's not nothing, but it is fairly benign. I was worried about the command history until I saw it was filtered, and that mostly allayed my misgivings.
placeybordeaux 10y ago
The research got computers to execute code on them without authorization and extracted information from them. That is a crime under the CFAA in the USA. Not sure what it is in Germany/EU.
- billyhoffman 10y ago
  "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'"
  - random28345 10y ago
    > "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'" The prosecuting attorney is going to tell a jury of twelve of your non-technical "peers" that it is hacking. Your client can either go to trial for seventeen thousand two hundred and eighty nine counts of felony hacking, and risk half a million years in prison, or they can plea bargain to 5 years in prison and a felony on his record. Or your client can hang himself, but I'm pretty sure a federal prosecutor counts that as a win too.
    - cplease 10y ago
      Yup. I'm surprised an advisor would sign off on this thesis.
  - flashman 10y ago
    That's an interesting point. Is there any case law on negligence versus malice?
- codedokode 10y ago
  What about Android apps (like Facebook) that collect phone numbers, contact lists, geolocation data, record sound without any user authorization?

tantalor 10y ago

The doc (http://incolumitas.com/data/thesis.pdf http://incolumitas.com/data/thesis.pdf) does have a short section on ethics, but IMHO it completely misses the point of the ethical concerns in running unauthorized, non-sandboxed code on devices you don't own. Instead it justifies the research by saying the threat cannot be shown unless the vulnerability is exploited, which is true, but that fact does not justify the research. The acknowledgements mention 2 of the university advisers and a PyPi admin consented to the "notification program". Still, people with good intentions have been prosecuted and convicted for less. I would be very concerned for this student.

SolarNet 10y ago

Yea, this would never get past my university's ethics department. I'm actually surprised he was allowed to do this. Maybe it's partially due to the fact our ethics department is also worried about liability.

markbnj 10y ago

Perhaps this could have been made cleaner by relying on the package manager for download counts only, and then demonstrating the code execution scenario on research machines only. If you wanted to avoid actually downloading anything to the user's machine (after all, they expect a 404 in this case, not a package even be it a harmless one) you'd perhaps need the cooperation of the repo admins to a greater extent. Anyway, this is all part of why I always try to build inside a container, or at least in a virtualenv where I don't need to sudo the install.

placeybordeaux 10y ago

Yeah I wouldn't want to find myself in court hearing >17000 computers were forced to execute [unauthorized] arbitrary code Certainly a crime in the US, not sure about Germany. Nice execution though!

twinkletwinkle 10y ago
I'm not so sure - were they forced? Could you take the maintainer of `requests` to court too? If someone types `pip install reqeusts` and gets something they maybe didn't expect, did you really force them?
- darkarmani 10y ago
  Are you asking if the maintainer of 'requests' decides to spy on computers and phone home information? What packages do this?
  - twinkletwinkle 10y ago
    Not a laywer, I'm just picking nits. It seems to me when you pip install a package, you are saying "download <this thing> and run its setup.py file". What if requests did something you didn't like, something simple like write a new directory or change the name of a certain file. Could you sue over that? Where is the distinction?
    - placeybordeaux 10y ago
      No one would be suing. This would be criminal. I was thinking that a simple way this would be illegal in the US would be "[accessing] a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer" See a2C here: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#Criminal_offenses_under_the_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#C... I'd assume you can make a decent case that the person only authorized the installation of a piece of software, not the gathering of identifying information. IP addresses can be used as identifying information especially when paired with a timestamp. Being an American citizen living in the US I would not want my name on this paper.

21 10y ago

I wonder about the legality. It looks to me like he isn't technically responsible, since he didn't access any authorized computer himself. If I intentionally leave an infected USB drive on the ground, someone picks it up and sticks it into it's computer, am I liable? Seems like it could go either way.